mirror_html/filegator
1
0
Fork 0
mirror of https://github.com/filegator/filegator.git synced 2025-08-05 03:47:54 +02:00
Code Issues Projects Releases Wiki Activity

invalidate sessions when the password is changed - json auth adapter

Browse Source
This commit is contained in:
Milos Stojanovic
2021-07-05 14:49:12 +02:00
parent f237bd4aa8
commit 0de9e6c895
3 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
backend/Services/Auth/Adapters/JsonFile.php
View File

@@ -22,6 +22,7 @@ class JsonFile implements Service, AuthInterface
use PasswordHash;
const SESSION_KEY = 'json_auth';
const SESSION_HASH = 'json_auth_hash';
const GUEST_USERNAME = 'guest';
@@ -45,7 +46,20 @@ class JsonFile implements Service, AuthInterface
public function user(): ?User
{
return $this->session ? $this->session->get(self::SESSION_KEY, null) : null;
if (! $this->session) return null;
$user = $this->session->get(self::SESSION_KEY, null);
$hash = $this->session->get(self::SESSION_HASH, null);
if ($user) {
foreach ($this->getUsers() as $u) {
if ($u['username'] == $user->getUsername() && $hash == $u['password']) {
return $user;
}
}
}
return null;
}
public function authenticate($username, $password): bool
@@ -56,6 +70,7 @@ class JsonFile implements Service, AuthInterface
if ($u['username'] == $username && $this->verifyPassword($password, $u['password'])) {
$user = $this->mapToUserObject($u);
$this->store($user);
$this->session->set(self::SESSION_HASH, $u['password']);
return true;
}